# CVE-2026-5142: Foreman authorization bypass in KeyPairsController taxonomy scoping

Source: https://junglewise.ai/threats/cve-2026-5142-foreman-authorization-bypass-in-keypairscontroller-taxonomy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-5142 · Severity: medium · CVSS 6.5 · Published 2026-07-01

A security flaw in the Foreman infrastructure management tool allows authorized users to access and download private SSH keys belonging to other organizations or tenants. In multi-tenant environments, this could lead to unauthorized access to remote servers and the exposure of sensitive credentials. An attacker only needs basic viewing permissions within their own organization to exploit this weakness and access data from others.

## Quick answers

**Is CVE-2026-5142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5142 being exploited in the wild.

**How severe is CVE-2026-5142?** Medium severity, with a CVSS score of 6.5, published 1 July 2026.

**Which products and versions are affected?** The Foreman Project Foreman; Red Hat Satellite 6.

**Is there a fix for CVE-2026-5142?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5142 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5142?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the KeyPairsController#show component of Foreman due to improper taxonomy scoping. Authenticated users with the 'view_keypairs' permission (such as those with a 'Viewer' role) can bypass organizational boundaries by directly querying specific KeyPair IDs. Because these IDs are often predictable or enumerable, an attacker can perform cross-tenant data extraction to obtain private SSH keys. This issue affects multi-tenant deployments where data isolation between organizations is required. The vulnerability is tracked as CWE-639 (Insecure Direct Object Reference).

## Affected products

- The Foreman Project Foreman
- Red Hat Satellite 6

## Timeline

- 2026-03-30: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-01: advisory: CVE published and NVD record created

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-5142](https://access.redhat.com/security/cve/CVE-2026-5142)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452999](https://bugzilla.redhat.com/show_bug.cgi?id=2452999)